PaperCut MF/NG Web Management Interface Improper Access Control Vulnerability (CVE-2026-81578) Advisory

1. Apply Official Security Patches

Immediately upgrade your PaperCut MF/NG instances to the latest secure versions recommended in the official PaperCut Security Bulletin.

2. Temporary Mitigations (Pre-patch)

If patching cannot be performed immediately, implement the following network-level mitigations:

• Restrict Management Port Access:

Block external internet access to the PaperCut web administration ports (default TCP 9191 and 9192).

• Firewall ACL Configuration Example (Linux iptables):

  # Allow only trusted admin IP (e.g., 192.168.1.100) to access ports 9191 and 9192
  iptables -A INPUT -p tcp -s 192.168.1.100 --dport 9191 -j ACCEPT
  iptables -A INPUT -p tcp -s 192.168.1.100 --dport 9192 -j ACCEPT
  iptables -A INPUT -p tcp --dport 9191 -j DROP
  iptables -A INPUT -p tcp --dport 9192 -j DROP

• WAF (Web Application Firewall) Rules:

Deploy rules to detect and block unauthorized requests targeting administrative endpoints (e.g., /app?service=page/Admin...) originating from unauthenticated external sessions.

CVE-2026-81578 is a critical improper access control vulnerability (CWE-305) residing in the web management interface of PaperCut MF and PaperCut NG.

Under specific conditions, the application processes backend actions triggered by unauthenticated remote requests targeting administrative functions prior to completing access validation checks. This race-like or flawed validation sequence allows an unauthenticated remote attacker to modify critical system configurations.

Given that this vulnerability is actively exploited in the wild (listed in CISA KEV) and has public exploit integration (such as Metasploit framework pull requests), it poses an immediate and severe risk of full system compromise.